For a med spa with injectors, an aesthetician, a front desk and an owner, Yodl is our first pick: $10 a month per location with a signed BAA, and a second location is another $10 rather than another round of per-seat fees. Microsoft Teams Essentials is the pick if you already use Microsoft 365, and Zenzap is worth a look if staff want WhatsApp-style chat and you will pay for its HIPAA add-on. WhatsApp itself is the common mistake.
Why the WhatsApp group is the common mistake
Almost every med spa we talk to started with a WhatsApp group. It is free, the injectors already use it, and a before-and-after photo sent at 6 p.m. gets a reply in seconds. The problem is what that photo is. A client's face, name or treatment record is protected health information (PHI) when it sits with a medical service like neuromodulator or filler treatment, and state privacy rules may apply even where HIPAA does not. Meta's terms for the WhatsApp Business Platform say Meta is not a business associate, which means there is no Business Associate Agreement (BAA), the contract HIPAA requires before a vendor may hold PHI for you.
There is also the owner problem. A WhatsApp group has no admin, no audit log and no retention control. When an injector leaves for the spa across town, every photo and every membership note in that group leaves on her phone. Whether your spa is a HIPAA covered entity depends on whether it runs standard electronic transactions such as insurance billing, and many cash-pay spas do not, but the photos are just as sensitive either way.
How we chose
- A BAA on the plan a 5-person spa would buy.
- Price for 5 people and for a second location.
- Private channels and file previews for photos, consult notes and consent forms.
- Apps on staff phones, because injectors are rarely at a desk.
- Admin control: who is in, who can post, who left, and an audit trail.
Prices are as of November 2026, from each vendor's own site. They change, so verify before you buy.
The list at a glance
| Tool | Price for 5 people as of November 2026 | Signs a BAA | Free tier | Best for |
|---|---|---|---|---|
| Yodl (Team plan) | $10 a month flat, 5 users included | Yes, every plan | No | One or two locations that want channels at a flat price |
| Microsoft Teams Essentials | $20 a month ($4 per user, paid yearly) | Yes, by default on commercial plans | Yes (consumer Teams, not covered) | Spas already on Microsoft 365 |
| Zenzap Business+ | $50 total a month, up to 5 users, plus an unpriced HIPAA add-on | Yes, as a paid add-on | Yes (unlimited users, 1 GB) | Staff who want WhatsApp-style chat with to-dos |
| Chanty Business | $15 a month ($3 per user billed annually; $4 monthly) | Yes, Business plan | Yes (up to 5 members, no BAA listed) | Teams of 2 or 3 |
| Slack Pro | $43.75 a month (monthly billing); the BAA needs an Enterprise plan | Enterprise plans only | Yes (90-day history) | Spas already on Slack Enterprise |
| Pumble | $0 with unlimited users, or Pro at $2.49 per seat a month (annual) | No HIPAA or BAA statement found | Yes | General chat with no client information |
| $0 | No; Meta's terms say it is not a business associate | Yes | Nothing that involves a client |
The tools, one by one
Yodl
Yodl is first because its price is per location, not per seat, and the BAA comes with the $10 plan. One location with 5 users and 20 GB is $10 a month; a second location is another $10 with 5 more users, and extra people are $2 each. Make #injectors private for before-and-after photos and consult notes, keep #front-desk for membership renewals and package balances, and use a channel per location so the Tuesday injector schedule at one site does not bury the other. Files preview in the thread, search covers the rooms you belong to, and the audit viewer, retention controls and invite-only workspace give the owner control. No calls, no SSO yet, iPhone app in beta.
Microsoft Teams Essentials
Teams Essentials is $4 per user a month paid yearly, so 5 people cost $20 and 9 people across two sites cost $36, on an auto-renewing annual subscription. Microsoft's HIPAA BAA applies by default on commercial plans through its Online Services Data Protection Addendum. It is the sensible choice when the spa already runs on Microsoft 365, and the heavier choice when it does not.
Zenzap
Zenzap is the closest to the WhatsApp feel, with to-dos, checklists, scheduled messages and a WhatsApp chat migration tool. Business+ is $50 total a month for up to 5 users with the annual toggle selected by default, and the HIPAA compliance and signed BAA add-on has no published price. Teams above 5 users see 'Book a Demo'. Budget for the add-on before you compare it with anything else.
Chanty
Chanty's Business plan lists HIPAA compliance and a BAA at $3 per user a month billed annually, or $4 monthly. For an owner plus two injectors that is $9 a month, cheaper than any flat plan. The free plan allows 5 members but does not list the BAA, so do not run the spa on it.
Slack
Slack Pro is $8.75 per user a month on monthly billing or $7.25 annual, but Slack's HIPAA support is limited to Enterprise plans with an executed BAA and DLP monitoring. For a 5-person spa the practical answer is that Slack's BAA is out of reach.
Pumble
Pumble is free for unlimited users with 10 GB per workspace; Pro is $2.49 per seat a month billed annually. Our research found no HIPAA or BAA statement on its site, so it works for the holiday schedule and the supply order, not for anything with a client's name or face.
WhatsApp is free and end-to-end encrypted, which sounds safe, but encryption is not a BAA and there are no admin controls, audit logs or retention policies. If staff love the feel, Zenzap or Yodl keeps most of it. See Yodl vs WhatsApp.
Which one for your spa
- One location, 4 to 8 people: Yodl, $10 for the first 5 and $2 for each extra person.
- Two locations, around 9 people: Yodl at $20 (10 users included across both sites) or Teams Essentials at $36 paid yearly.
- Owner plus one or two injectors: Chanty Business at $3 per user a month billed annually.
- Already on Microsoft 365: Teams, with the BAA already in place.
- Staff who refuse anything that does not feel like WhatsApp: Zenzap, once sales quotes the HIPAA add-on.
Yodl is $10 a month per location for 5 people with a signed BAA, on the pricing page.
Replace the WhatsApp group with a tool that signs a BAA and gives the owner control over who sees the photos. For one or two locations, Yodl's $10 per location is the simplest way to do that.
Frequently asked questions
Is WhatsApp fine for staff if we never send photos?
No. A client's name next to an appointment or a membership note is still PHI, and WhatsApp has no BAA, no admin controls and no audit log.
Does HIPAA apply to a cash-pay med spa?
It depends on whether the spa is a covered entity, which turns on electronic insurance transactions. Many cash-pay spas are not, but state privacy and medical-record laws still apply, and a BAA-covered tool is the safe default either way.
Can we share before-and-after photos in team chat?
Yes, inside a tool that has signed a BAA, in a private channel limited to the people treating that client, with the photo of record kept in your charting system.
What is the cheapest option for two locations?
Yodl at $20 a month covers two locations with 10 users included. Teams Essentials is $4 per user paid yearly, so it is cheaper only up to 4 people in total.
Does Yodl do video calls or text clients?
No. Yodl is staff-to-staff chat with no voice or video calls and no SMS. Client texting needs a separate patient-messaging tool.